The present invention generally relates to methods and systems for securing computer systems. More particularly, the present invention relates to methods and devices containing a security partition and a disc drive architecture for securing information in a system, which may be connected to a networked environment.
Computer operating systems or platforms play a central role in electronic commerce, as well as in day-to-day business operations for large and small companies alike. As more computer systems become connected to networks (private and public), the need to secure information has become critical. Unfortunately, traditional operating systems provide limited security.
To protect information, most business have taken steps to protect individual server platforms. However, no overall corresponding improvement in client platforms has been implemented, in part, because of the variety of client platforms and because of the cost. While the PC platform provides the benefits of flexibility and openness, fueling exceptional economic growth, the same benefits also expose users to security breaches, such as hackers, viruses, and the like.
It is sometimes possible to detect whether software has been modified, provided that it is known what element of the OS might have been modified. However, current computing platform technologies do not allow a local or remote user to test whether a platform can be trusted with sensitive information. For example, a host system can verify that a particular user is accessing the system, but it is difficult (if not impossible) to establish with certainty whether the particular user's computing platform is a corporate machine and whether it runs the required software and configurations.
With the advent and widespread deployment of the Internet, the deficiencies of conventional computer security systems have been exposed and sometimes exploited. A disadvantage of the Internet is that it permits many ways to infiltrate the perimeter defenses of conventional computer systems. Damaging virus programs, for example, can be injected through firewalls and into a computer system. Generally, infiltration of these perimeter defenses can compromise data and computer programs, which can impact derivative capabilities, such as digital rights management.
While software has been developed to provide some protection on a platform by platform basis, software-only security implementations are dependent on proper installation and execution. A conventional example of such localized computer system security is virus detection software. Virus detection software, however, can be susceptible to exploitation by, for example “spoofing” or “wrappering” strategies. In a compromised system, virus detection software may be made to appear operational, even when it is not operating properly. This highlights a fundamental problem with conventional computer security systems, namely that the security system operates within the same environment as the operating system. Software security implementations (such as virus detection software) may be impacted by software that has already been executed on the software platform. The phrase “software platform” as used herein generally refers to the operating environment or operating system (OS). Even tightly controlled software cannot vouch for its own integrity. For example, if malicious software, such as a virus, has bypassed the perimeter defenses or security features of the OS and has managed to corrupt its operation, the OS cannot be expected to recognize the security breach, reliably.
Furthermore, the operating system environment for many computer systems is also common, for example, to the Internet environment or to another network communications medium. Because of the commonality between the client operating system and the operating environment, many means of attack on a computer system are available merely by moving computer code, for example, from the Internet to the computer operating system.
Some conventional methods of computer protection may involve special purpose security hardware or firmware installed in the BIOS of a computer system. These methods can establish secondary lines of defense internal to operation of a computer system but external to the complicated and error-prone operating system environment.
Other conventional computer security systems may include a security device connected to a SCSI bus that protects storage devices on the bus. This type of security system recognizes that the storage device is more secure while not operating in an environment common to the operating system. However, the SCSI bus of this system exposes all devices on the bus, including the storage devices. Specifically, the SCSI bus exposes all devices on the bus by allowing access to the attached devices. Therefore, effective utilization of a security device attached to a SCSI bus requires intimate operating systems involvement.
Still other computer security systems recognize the benefit of guarding the storage device at the controller level but are based on shared private keys. Shared private keys are well-known to provide less security than securing and concealing elements of public-private key encryption, because authentication keys are shared and are not private to a single device. This type of system suffers the same problem of operating system dependence illustrated above, because it is also directed to modification of the file management system of the computer operating system.
In another type of computer security system, the security perimeter consists of self-contained software that exports only a simple storage interface for external access and that verifies the integrity of each command before processing the command. By contrast, most file servers and client machines execute a multitude of services that are susceptible to attack. Typically, such a system provides for automated recovery to a known good state, relying on secure storage mechanisms. Unfortunately, this type of system also requires operating systems modification. The automated recovery system incorporates complexity and, therefore, vulnerability, approaching that of an OS. Moreover, the automated recovery system permits opportunities for the introduction of Trojan horses, and the like. “Trojan Horse” is a generic term for a irus or a security-violating program or script that is disguised as something else. Typically, a Trojan Horse masquerades as a benign program, like a directory Lister for example, but which contains a trap door or attack program that can be used to break into a network.
The ATA Host Protected Area security protocol provides security to a computer system by hiding a portion of a storage media of a storage device during the boot phase of a computer system. In this method, the storage device hides a portion of the storage media by telling the operating system that the storage device has less storage space than the storage device actually has. The undeclared storage space represents an area of the storage media that is essentially inaccessible to the BIOS. Special BIOS firmware or other special code can have exclusive access to the hidden or undeclared portion of storage device. As an additional security measure, the ATA Host Protected Area can require passcode access to this additional amount of storage space. The ATA Host Protected Area was originally designed to provide security assurance in the form of an enhanced operating system and application crash recovery system. For example, the hidden or undeclared portion of the storage device can be used to cache a known good version of the system or application software, outside the capability of the operating system to address. In practice, this restricts access to a portion of the storage device to a computer program running either in the main device firmware or in the operating system environment.
However, the ATA Host Protected Area protocol has a security hole in that it is still possible to intercept communications with the storage device. The hidden ATA Host Protected Area partition of the storage device can be revealed, for example, by putting that same disc drive into another computer that does not reserve the Host Protected space. The passcode, if used, is not retained across power cycles. While the ATA Host Protected Area is an acceptable place to protect local backup code and data from virus-like infections, the ATA Host Protected Area is typically not the best place to conceal data. Furthermore, the only authentication required by ATA Host Protected Area is a “first come, first served, winner take all” type of device authentication.
Still another type of computer security system involves a Trusted Computing Platform (TCP). In general, a trusted platform (TP) is a computing platform that is trusted by local users and remote entities, including users, software, web sites and all third parties. To enable a user to trust a computing platform, a trusted relationship must be built between the user and the computing platform, which can verify to the user that an expected boot process, a selected operating system, and a set of selected security features in the computing platform have been properly installed and are functioning correctly. An organization called the “Trusted Computing Platform Alliance” (TCPA, and later reconstituted as the Trusted Computing Group, TCG) has defined a specification for the TCP. The TCPA/TCG via the specification advocates that a separate mechanism, called the Subsystem, be used to establish trust relationships between various modules and components within the system and with other entities. Generally, the subsystem includes a Trusted Platform Module (TPM) and software for performing integrity metrics in conjunction with the TPM.
The Subsystem is designed to prevent logical, or software-based attacks. Generally, the Subsystem establishes a hardware-based foundation for trust, based on a set of integrity metrics, which are defined as measurements of key platform characteristics. Specifically, the integrity metrics are measurements that can be used to establish platform identity, such as BIOS, boot-loader, OS loader, and OS security policies. Cryptographic hashing techniques are used to extend trust from the BIOS to other areas of the platform.
Any type of computing platform (for example, a PC, server, personal digital assistant (PDA), printer, mobile phone, or any other networkable device) may be a trusted platform. A trusted platform is particularly useful for mobile platforms that are connected to a network, in part, because physical mobility coupled with connectivity increases the need for stronger trust and confidence in the computer platform. In particular, such connectivity and mobility increases the likelihood of viruses and of unauthorized access to critical systems. Unfortunately, though the present trusted drive architecture prevents the drive from being compromised by logical or software based attacks, the Subsystem may, optionally, still be compromised by physical means, which can expose the secrets of the Subsystem.